N-able has confirmed that attackers exploiting CVE-2026-18577, an unauthenticated authentication bypass in its N-central remote monitoring and management platform, obtained administrative control of vulnerable servers and then used the platform's own Take Control feature to reach systems inside downstream managed environments. That confirmation, reported by The Register on August 7 and echoed across Help Net Security, Dark Reading and SecurityWeek, converts what began as a patch-bypass advisory into a verified RMM supply-chain intrusion. The flaw carries a CVSS score of 8.2 (Dark Reading), affects both hosted and on-premises deployments, and was added to CISA's Known Exploited Vulnerabilities catalog on August 3, with the predecessor bug CVE-2026-18556 added on August 5 (Rapid7). N-able says a "limited number" of customers were impacted but has not quantified that figure. Independent telemetry so far is narrow: Huntress reports exploitation affecting one organization in its customer base, and Sophos Counter Threat Unit reports a single compromised organization in its own, with no evidence of widespread compromise.
What Happened
The accounts across sources agree on the shape of the incident and differ on the clock. N-able's own narrative, quoted by Help Net Security and Dark Reading, starts on July 31, 2026, when the vendor saw an unusual volume of licensing issues among on-premises N-central customers. Engineering and security teams were engaged, and on the morning of August 2 the analysis of a previously patched authentication bypass, CVE-2026-18556 (fixed in 2026.2), exposed a second vector into the same weakness. That new vector was assigned CVE-2026-18577.
Dates of first exploitation are reported inconsistently and the discrepancy is worth stating plainly. Rapid7 says N-able observed exploitation in the wild since August 1. Sophos says N-able published an additional advisory on August 4 indicating that exploitation began on July 31 as a zero-day. SecurityWeek characterises it differently again, arguing CVE-2026-18577 is not a new zero-day but a bypass of the CVE-2026-18556 patch that threat actors began exploiting in late July. Sophos also notes that the incomplete-fix explanation has been reported but not directly confirmed by N-able. Advisory publication dates likewise diverge: Sophos places N-able's disclosure advisory on August 1, while Rapid7 places it on August 2. Treat the exploitation window as late July through early August rather than any single fixed date.
The remediation timeline is firmer. Hotfix 1, version 2026.3.1.7, shipped on August 2 (Rapid7, Help Net Security). Hotfix 2, version 2026.3.1.10, followed on August 6 (Huntress) and was covered by The Register on August 7. N-able has told on-premises customers that Hotfix 2 is mandatory even for those who already applied the first emergency fix, warning in its own communication that "this is not a duplicate of our previous communication." Hosted instances are patched automatically by the vendor; self-hosted deployments require manual action.
What Was Taken
No source in this set confirms a specific volume of exfiltrated data, and no record counts have been published. What is confirmed is access, which in an RMM compromise is the more consequential currency.
N-able has stated that attackers took over an administrator account, used Take Control to connect to managed endpoints, and registered a new Cloudflare Tunnel service on those devices to preserve persistence after access to the N-central server itself was revoked. The Register notes that N-able has not disclosed how many customers were affected, how many downstream systems attackers reached, or what was done once persistent access was established, and did not answer those questions when asked, instead supplying a statement that it is "proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques."
The clearest picture of post-access activity comes from Sophos CTU's single confirmed victim, compromised at approximately 08:00 UTC on August 3. There, the threat actor used the compromised N-central server to reach high-value infrastructure including a backup server, domain controllers and application servers. The actor created a new domain account named "veeam," reset passwords on several existing domain administrator accounts, and ran enumeration and reconnaissance commands including multiple net user invocations, nltest /dclist: and net group "domain admins" /domain. The actor then deployed additional RMM tooling to accessible endpoints, including AnyDesk and TacticalRMM installed via an install_server.ps1 PowerShell script. Domain administrator password resets and the creation of a plausible-looking backup service account are consistent with staging for ransomware or extortion, though none of the sources here confirm an encryption or extortion event.
Why It Matters
An RMM console is a pre-authorised administrative channel into every estate it manages. Huntress frames the impact bluntly from the MSP perspective: exploitation grants an attacker full administrative access to an N-central console, the same level of control normally reserved for trusted NOC and engineering staff, from which they can push scripts and jobs to many or all managed endpoints and deploy dual-use tooling. Rapid7 makes the same structural point: because the platform operates with extensive administrative privileges across customer environments, compromising one server is an efficient path to compromising everything downstream.
Three features of this incident deserve particular attention from defenders.
First, this is a patch-bypass event, not a clean single vulnerability. The fix for CVE-2026-18556 did not close the underlying weakness, and the fix for CVE-2026-18577 itself required a superseding second hotfix four days later. Any organisation that treated the August 2 patch as closure is still exposed.
Second, the persistence mechanism is designed to survive the obvious remediation. Registering a Cloudflare Tunnel on downstream endpoints means that revoking access to the N-central server, the natural first response, does not evict the actor. Patching without hunting is insufficient.
Third, the actor's follow-on tooling is legitimate software. AnyDesk and TacticalRMM are dual-use products that appear in normal MSP operations, which blunts signature-based detection and means the deployment of "an RMM tool" is only anomalous relative to what a given environment is supposed to be running.
The Attack Technique
The chain is short and entirely built from platform-native capability plus commodity tooling.
Initial access is a remote, unauthenticated authentication bypass against an internet-reachable N-central server, yielding administrative control of the management console. Huntress describes the resulting privilege level as "god-mode" access to the RMM console; because the flaw bypasses authentication outright, no credential theft or phishing stage is required.
Lateral movement into customer environments then uses Take Control, N-central's built-in remote-control feature, so the attacker traverses the trust boundary between MSP and customer using an intended, logged and expected function of the platform rather than an exploit.
Persistence is established on reached endpoints by registering a new Cloudflare Tunnel (cloudflared) service, providing outbound-initiated remote access that generally survives revocation of the N-central foothold and typically looks like ordinary HTTPS egress.
Post-exploitation, per Sophos CTU, comprises Active Directory enumeration, creation of a decoy domain account, password resets against existing domain administrators, and deployment of secondary RMM agents such as AnyDesk and TacticalRMM to broaden and diversify access. Attribution to a named group is not established in any of these sources.
What Organizations Should Do
- Apply Hotfix 2 (2026.3.1.10) to every on-premises N-central deployment immediately, including servers that already received Hotfix 1 (2026.3.1.7). N-able has stated Hotfix 2 is required regardless. Treat this as out-of-band remediation, not a scheduled patch cycle item, per Rapid7's guidance. Confirm that hosted instances have been upgraded by the vendor rather than assuming it.
- Remove N-central from untrusted network exposure. Huntress advises that if the server remains broadly reachable from the internet, defenders should consider temporarily disabling N-central, up to and including taking it offline, until the hotfix is applied and it can be reintroduced behind strict network controls. N-able additionally recommends upgrading N-central agents.
- Hunt for Cloudflare Tunnel persistence across managed endpoints, not just on the N-central server. Look for newly registered services running
cloudflared, unexpected outbound tunnel connections, and tunnel registrations dated between late July and the date you patched. Patching the console does not remove this foothold. - Audit identity infrastructure for the Sophos-documented post-exploitation pattern: newly created domain accounts (the observed victim saw an account named "veeam"), unexplained password resets on domain administrator accounts, and execution of
net user,nltest /dclist:andnet group "domain admins" /domain. Force credential rotation across privileged accounts if the server was exposed and unpatched during the exploitation window. - Inventory RMM and remote-access agents across the estate and flag any that are not on your approved list, specifically AnyDesk installations and TacticalRMM deployed via
install_server.ps1. Secondary RMM deployment is this actor's redundancy layer. - Review N-central logs for suspicious administrative logins and Take Control remote-control sessions over the exploitation window, and correlate those session times against endpoint activity. Note the caveat raised in coverage of the second hotfix: current detection guidance may only cover indicators identified so far, so absence of known IOCs is not proof of absence of intrusion. Assume compromise and validate, rather than assuming safety because a scan came back clean.
Sources: N-able confirms N-central breach path reached customer networks - P... | Critical N-able N-central Vulnerability and Active Exploitation Hu... | CVE-2026-18577: N-able N-central Authentication Bypass Exploited in... | N-able N-central exploitation results in RMM tool deployment SOPHOS | N-able God mode flaw: Vendor confirms attackers reached customer ne... | Attackers exploit N-able N-central flaw to reach managed endpoints... | Attackers Exploit N-able Patch Bypass Flaw on RMM Servers | N‑able Patches Vulnerability Exploited to Hack N-central Servers -...